CVE-2026-44208: Frappe: IDOR in `submit_discussion()`

Q: What is the severity of CVE-2026-44208?

The severity of CVE-2026-44208 is rated as medium with a CVSS score of 6.9.

Q: How do I fix CVE-2026-44208?

To fix CVE-2026-44208, upgrade to Frappe versions 15.107.0 or 16.17.0.

Q: What is CVE-2026-44208?

CVE-2026-44208 is a vulnerability in Frappe that allows unauthorized access to resources via the 'submit_discussion()' endpoint.

Q: Who is affected by CVE-2026-44208?

Users of Frappe prior to versions 15.107.0 and 16.17.0 are affected by CVE-2026-44208.

Q: When was CVE-2026-44208 published?

CVE-2026-44208 was published on June 12, 2026.

Published Jun 12, 2026

Updated

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submitdiscussion()" endpoint allows for unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

Affected Software

1 affected component

Frappe frappe<15.107.0, <16.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 15.107.0
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 16.17.0

Event History

Jun 12, 2026

CVE Published

via MITRE·02:26 PM

Data Sourced

via MITRE·02:26 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-44208?

The severity of CVE-2026-44208 is rated as medium with a CVSS score of 6.9.

How do I fix CVE-2026-44208?

To fix CVE-2026-44208, upgrade to Frappe versions 15.107.0 or 16.17.0.

What is CVE-2026-44208?

CVE-2026-44208 is a vulnerability in Frappe that allows unauthorized access to resources via the 'submit_discussion()' endpoint.

Who is affected by CVE-2026-44208?